CVE-2024-23243: Apple iPadOS Information Disclosure Flaw

CVE-2024-23243 Overview

CVE-2024-23243 is an information disclosure vulnerability in Apple iOS and iPadOS. The flaw stems from insufficient redaction of private data in system log entries. An installed application can read sensitive location information by parsing logs that should have masked that data. Apple addressed the issue by improving private data redaction for log entries in iOS 17.4 and iPadOS 17.4.

The vulnerability requires local access and user interaction, limiting its standalone impact. However, it can support broader attack chains where adversaries combine it with other techniques to track user movements or build a profile of the device owner.

Critical Impact
A malicious or compromised app installed on an iPhone or iPad can read sensitive location data exposed through unredacted log entries, enabling user tracking and privacy compromise.

Affected Products

Apple iOS prior to 17.4
Apple iPadOS prior to 17.4
Apple iPhone and iPad devices supporting these operating systems

Discovery Timeline

2024-03-05 - CVE-2024-23243 published to the National Vulnerability Database
2024-03-05 - Apple releases iOS 17.4 and iPadOS 17.4 with the redaction fix
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2024-23243

Vulnerability Analysis

The vulnerability is an information disclosure flaw [NVD-CWE-noinfo] in the logging subsystem of iOS and iPadOS. Apple's unified logging framework supports redaction of values marked as private. In affected versions, certain log entries containing sensitive location information were not properly redacted before being written to system logs.

A locally installed application that can read these log entries — or a process that gains access to log data through diagnostic interfaces — can recover GPS coordinates, geofence events, or other location-derived data. The flaw does not require elevated privileges, but it does require user interaction, such as installing or running the malicious app.

The practical impact is privacy violation rather than direct system compromise. Confidentiality is affected, while integrity and availability are not.

Root Cause

The root cause is improper redaction of fields classified as private in log format strings. When log entries containing location values were emitted by system components, the redaction logic failed to mask the values, leaving cleartext sensitive data in retrievable log buffers and diagnostic archives.

Attack Vector

An attacker delivers a malicious application through sideloading, configuration profile abuse, or by compromising a legitimate app. Once installed, the app queries log entries accessible to its sandbox or extracts sysdiagnose-style data. The app then parses the unredacted location information and exfiltrates it to an attacker-controlled endpoint.

No verified public exploit code is available for CVE-2024-23243. Refer to the Apple Support Document for iOS 17.4 for the vendor description of the issue.

Detection Methods for CVE-2024-23243

Indicators of Compromise

Unexpected applications requesting access to diagnostic logs, sysdiagnose archives, or device analytics data
Mobile applications transmitting unusually large or structured payloads containing latitude and longitude patterns to external endpoints
Configuration profiles installed outside MDM workflows that enable verbose logging or diagnostic capture

Detection Strategies

Inspect mobile device management (MDM) telemetry for iOS and iPadOS versions below 17.4 still active in the fleet
Review network egress from mobile devices for connections to unrecognized hosts following installation of new applications
Audit installed applications for entitlements granting access to logging or diagnostic data

Monitoring Recommendations

Track iOS and iPadOS version distribution and flag devices running versions earlier than 17.4
Monitor enterprise app catalog installations and sideloaded application activity through MDM reporting
Correlate location service usage with application behavior to identify apps reading location data outside their declared purpose

How to Mitigate CVE-2024-23243

Immediate Actions Required

Update all iPhone and iPad devices to iOS 17.4 or iPadOS 17.4 or later
Enforce minimum OS version compliance policies through MDM to block access for non-compliant devices
Audit installed applications and remove any that request unnecessary access to logs or diagnostics

Patch Information

Apple resolved CVE-2024-23243 in iOS 17.4 and iPadOS 17.4 by improving private data redaction for log entries. Full details are published in the Apple Security Release Notes (HT214081) and the Apple Support article. Apply the update through Settings, Software Update, or push it through MDM commands.

Workarounds

No vendor-supplied workaround exists; updating to iOS 17.4 or iPadOS 17.4 is the only supported remediation
Restrict installation of untrusted applications and configuration profiles until devices are patched
Disable detailed diagnostic logging and limit sharing of sysdiagnose archives with third parties on unpatched devices

bash

# Example MDM compliance check for minimum iOS version
# Pseudocode for an MDM policy rule
if device.os_family in ["iOS", "iPadOS"] and device.os_version < "17.4":
    device.compliance_status = "non_compliant"
    device.action = "block_corporate_access"
    device.notify_user = "Update to iOS/iPadOS 17.4 or later"